A practical approach to detection of distributed denial-of-service attacks using a hybrid detection method

Abstract

This paper presents a hybrid method for the detection of distributed denial-of-service (DDoS) attacks that combines feature-based and volume-based detection. Our approach is based on an exponential moving average algorithm for decision-making, applied to both entropy and packet number time series. The approach has been tested by performing a controlled DDoS experiment in a real academic network. The network setup and test scenarios including both highrate and low-rate attacks are described in the paper. The performance of the proposed method is compared to the performance of two methods that are already known in the literature. One is based on the counting of SYN packets and is used for detection of SYN flood attacks, while the other is based on a CUSUM algorithm applied to the entropy time series. The results show the advantage of our approach compared to methods that are based on either entropy or number of packets only. Keywords:network security, denial of service attack, exponential weighted moving average, CUSUM, packet entropy IntroductionModern technological society is greatly dependent on Internet technology and online services. Internet services have become a non-exclusive part of everyday routine. Many of us check our e-mail as the first thing we do in the morning. This kind of service dependence has made room for a new kind of manipulation and has introduced attacks on network services. Denial of Service (DoS) attacks are among these attacks. Their goal is to make a targeted service unavailable by overloading service provider resources with false requests. With resources depleted, the service provider is not able to serve legitimate users. Nowadays, DoS is a commonly-used attacking method which inflicts significant financial loss on its targets [1]. According to [2,3] there are different types of DoS attacks. At the * P.D. Bojovic

Lucid: A Practical, Lightweight Deep Learning Solution for DDoS Attack Detection

“…The authors observed that the variation in source IP address entropy and chi-square statistics due to fluctuations in legitimate traffic was small, compared to the deviations caused by DDoS attacks. Similarly, [26] combined entropy and volume traffic characteristics to detect volumetric DDoS attacks, while the authors of [27] proposed an entropybased scoring system based on the destination IP address entropy and dynamic combinations of IP and TCP layer attributes to detect and mitigate DDoS attacks.…”

Flow Correlation Degree Optimization Driven Random Forest for Detecting DDoS Attacks in Cloud Computing

“…However, the training convergence speed of this method is slow. Bojović et al [13] proposed a DDoS attackdetection method based on an exponential moving average algorithm. However, this method cannot detect attacks well when the packet forwarding rate of attack traffic is small.…”

A Meta-analytic Review of Intelligent Intrusion Detection Techniques in Cloud Computing Environment

“…The fitness functions for each solution or search agent in the swarm leads to proposal of taxonomy and identification of the best fit solution to the problem. Swarm Intelligence algorithms have been used in optimization problems such as Agent Swarm Optimization (ASO) with the coexistence of different agents and their interaction, to ensure problem specificity, facilitation for testing and application to real-life problems [13]. One of the concepts significantly used in cloud computing is virtualization, as it enables higher resource utilization and lower operating costs.…”